Количество 12
Количество 12
BDU:2024-02614
Уязвимость платформы для мониторинга и наблюдения Grafana, связанная с неправильной нейтрализацией ввода во время создания веб-страницы, позволяющая нарушителю внедрять введенный URL-адреса
CVE-2022-39324
Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.
CVE-2022-39324
Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.
CVE-2022-39324
Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.
CVE-2022-39324
Grafana is an open-source platform for monitoring and observability. P ...
ALT-PU-2023-1161
ALT-PU-2023-1161: package `grafana` update to version 8.5.20-alt1
ALT-PU-2022-3295
ALT-PU-2022-3295: package `grafana` update to version 9.3.1-alt1
ROS-20240404-01
Множественные уязвимости grafana
GHSA-4724-7jwc-3fpw
Grafana Spoofing originalUrl of snapshots
SUSE-SU-2023:0821-1
Security update for grafana
SUSE-SU-2023:0812-1
Security update for SUSE Manager Client Tools
ELSA-2023-6420
ELSA-2023-6420: grafana security and enhancement update (MODERATE)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2024-02614 Уязвимость платформы для мониторинга и наблюдения Grafana, связанная с неправильной нейтрализацией ввода во время создания веб-страницы, позволяющая нарушителю внедрять введенный URL-адреса | CVSS3: 3.5 | 1% Низкий | больше 3 лет назад |
 | CVE-2022-39324 Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8. | CVSS3: 6.7 | 1% Низкий | больше 3 лет назад |
 | CVE-2022-39324 Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8. | CVSS3: 6.7 | 1% Низкий | больше 3 лет назад |
 | CVE-2022-39324 Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8. | CVSS3: 6.7 | 1% Низкий | больше 3 лет назад |
| CVE-2022-39324 Grafana is an open-source platform for monitoring and observability. P ... | CVSS3: 6.7 | 1% Низкий | больше 3 лет назад |
| ALT-PU-2023-1161 ALT-PU-2023-1161: package `grafana` update to version 8.5.20-alt1 | CVSS3: 8.7 | больше 3 лет назад | |
| ALT-PU-2022-3295 ALT-PU-2022-3295: package `grafana` update to version 9.3.1-alt1 | CVSS3: 9.8 | почти 4 года назад | |
 | ROS-20240404-01 Множественные уязвимости grafana | CVSS3: 9.4 | больше 2 лет назад | |
| GHSA-4724-7jwc-3fpw Grafana Spoofing originalUrl of snapshots | CVSS3: 6.7 | 1% Низкий | больше 2 лет назад |
 | SUSE-SU-2023:0821-1 Security update for grafana | больше 3 лет назад | ||
| SUSE-SU-2023:0812-1 Security update for SUSE Manager Client Tools | больше 3 лет назад | ||
| ELSA-2023-6420 ELSA-2023-6420: grafana security and enhancement update (MODERATE) | почти 3 года назад |
Уязвимостей на страницу